felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(profile): some fix on the dpkg-scipts profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:10:48 +02:00
parent 010ccf43e3
commit b2afeee510
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
5 changed files with 16 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/apt/dpkg-script-apparmor
View file

@ -9,10 +9,10 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/apparmor* @{exec_path} = /var/lib/dpkg/info/apparmor*
profile dpkg-script-apparmor @{exec_path} { profile dpkg-script-apparmor @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/perl>
@{exec_path} mr, @{exec_path} mrix,
@{sh_path} rix, @{sh_path} rix,
@{bin}/grep ix, @{bin}/grep ix,
@ -21,6 +21,7 @@ profile dpkg-script-apparmor @{exec_path} {
@{bin}/deb-systemd-invoke Px, @{bin}/deb-systemd-invoke Px,
@{bin}/dpkg-divert ix, @{bin}/dpkg-divert ix,
@{bin}/systemctl Cx -> systemctl, @{bin}/systemctl Cx -> systemctl,
@{sbin}/apparmor_parser Px,
/usr/share/apparmor.d/** rw, /usr/share/apparmor.d/** rw,

11
apparmor.d/groups/apt/dpkg-script-linux
View file

@ -22,11 +22,12 @@ profile dpkg-script-linux @{exec_path} {
@{bin}/run-parts ix, @{bin}/run-parts ix,
@{bin}/stty ix, @{bin}/stty ix,
@{bin}/dpkg-trigger Px, @{bin}/dpkg-trigger Px,
@{bin}/kmod Px, @{bin}/kmod Px,
@{bin}/linux-check-removal Px, @{bin}/linux-check-removal Px,
@{bin}/linux-update-symlinks Px, @{bin}/linux-update-symlinks Px,
@{bin}/whiptail Px, @{bin}/whiptail Px,
@{bin}/dpkg-maintscript-helper Px,
/usr/share/{update,reboot}-notifier/notify-reboot-required Px, /usr/share/{update,reboot}-notifier/notify-reboot-required Px,
/etc/kernel/{,header_}postinst.d/* Px, /etc/kernel/{,header_}postinst.d/* Px,

1
apparmor.d/groups/apt/dpkg-script-systemd
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/systemd* @{exec_path} = /var/lib/dpkg/info/systemd*
profile dpkg-script-systemd @{exec_path} { profile dpkg-script-systemd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/consoles> include <abstractions/consoles>
@{exec_path} mrix, @{exec_path} mrix,

4
apparmor.d/groups/apt/dpkg-script-tmp
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) { profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/perl>
@{exec_path} mrix, @{exec_path} mrix,
@ -22,6 +23,9 @@ profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) {
@{bin}/dpkg-maintscript-helper Px, @{bin}/dpkg-maintscript-helper Px,
@{bin}/kmod Cx -> kmod, @{bin}/kmod Cx -> kmod,
@{bin}/systemctl Cx -> systemctl, @{bin}/systemctl Cx -> systemctl,
/usr/share/debconf/frontend Px,
/usr/share/debconf/confmodule r,
/etc/kernel/preinst.d/*-microcode ix, /etc/kernel/preinst.d/*-microcode ix,

4
apparmor.d/groups/apt/dpkg-scripts
View file

@ -62,8 +62,8 @@ profile dpkg-scripts @{exec_path} {
@{lib}/ r, @{lib}/ r,
/etc/ r, /etc/ r,
/etc/** rw, /etc/** rw,
/usr/share/*/ r, /usr/share/*/{,**} rw,
/usr/share/*/** rw, /usr/local/share/*/{,**} rw,
/var/** rw, /var/** rw,
@{run}/** rw, @{run}/** rw,
@{efi}/grub/* rw, @{efi}/grub/* rw,